Re: OpenLDAP-Client TLS

2012-11-16 Thread Ralf Haferkamp
On Fri, Nov 16, 2012 at 09:45:10AM +0100, martin.heinzm...@belden.com wrote: > > > Hi, > i am trying to write my own client which connects to an active directory > and searches for an user. So far it works, i call "ldap_initialize", set > version 3, "ldap_simple_bind_s" and then search the direct

Re: LDAP_OPT_X_TLS_xxx option in SSL/TLS connection

2012-03-05 Thread Ralf Haferkamp
Am Donnerstag 01 März 2012, 11:49:22 schrieb Michael Ströder: > Qiang Xu wrote: > > Guess what? Just picked up a pearl in the sea of internet: > > http://www.mailinglistarchive.com/postfix-us...@postfix.org/msg5768 > > 8.html > > > > Basically, it seems to be a feature introduced since the beginni

Re: Ldap problems in paradise, working with suse 12.1 miles stone 5

2011-12-22 Thread Ralf Haferkamp
Am Mittwoch 21 Dezember 2011, 15:00:24 schrieb John Tobin: > Dear Ralf, > > Hi, I hope you are still here before the holidays, I would appreciate > your advice and counsel. > I have Suse 12.1 up, mile stone 5. It works well. The final 12.1 release is out since almost 6 weeks, you should really up

Re: RootDSE search, add attributes

2011-12-08 Thread Ralf Haferkamp
Hi, Am Mittwoch 07 Dezember 2011, 20:29:47 schrieb w.sieb...@t-systems.com: > Hello, > > my application sends a root_dse search, (objectclass=*) without any > attributes. So openldap answers with 2 lines: > > Top objectClass: top > objectClass: OpenLDAProotDSE > > But I need all attributes and

Re: Compile Error for ldapc++ library

2011-11-10 Thread Ralf Haferkamp
Am Mittwoch 09 November 2011, 09:56:18 schrieb sim123: > I am trying to compile ldapc++ library distributed with openldap-2.4.26 > and getting following error during make: > > ../src/LDAPAsynConnection.h: In function ‘int main(int, char**)’: > ../src/LDAPAsynConnection.h:310: error: > ‘LDAPAsynCon

Re: adding monitor to cn=config on already running slapd

2011-10-17 Thread Ralf Haferkamp
On Freitag 14 Oktober 2011 18:53:30 Craig White wrote: > On Oct 14, 2011, at 5:44 AM, Ralf Haferkamp wrote: [..] > > > > The other entries of your LDIF seem broken in similar ways, btw. > > > this worked... (thanks) > # Load dynamic backend modules > dn: cn=mo

Re: adding monitor to cn=config on already running slapd

2011-10-14 Thread Ralf Haferkamp
On Donnerstag 13 Oktober 2011 19:30:01 Craig White wrote: > The openldap guide suggests that the configuration for dynamic > configuration is yet to be written and it seems it is probably easy > to get configured from the start but not intuitive enough for me to > add to an already running server.

Re: Removing cn=config elements (Not at runtime)

2011-10-12 Thread Ralf Haferkamp
On Dienstag 11 Oktober 2011 21:18:18 Jeffrey Crawford wrote: > I have seen in the list archives that using ldapmodify to remove > cn=config elements while openldap is running is not supported. > > However I do need to be able to disable overlays in certain cases > sometimes (Even if it's for testi

Re: Database indexing: slapindex

2011-07-19 Thread Ralf Haferkamp
On Mittwoch 13 Juli 2011 09:49:06 openl...@ayni.com wrote: > Hi listers > > Installation here: > openldap-servers-2.4.15-7.fc11.i586 > > One master server, two backup servers (syncrepl). > > All authentication and mailing is managed by ldap. > > 1. About indexing: > > When i check the slapd-lo

Re: Recommended strategy for replicating cn=config database

2011-07-13 Thread Ralf Haferkamp
On Dienstag 12 Juli 2011 19:38:57 Jonathan Underwood wrote: > Hi, [..] > where rid=001 corresponds to the entry: > > olcSyncRepl: rid=001 > provider=ldap://auth0.domain > bindmethod=sasl saslmech=gssapi > searchbase="cn=config" > type=refreshAndPersist > retry="30 30 300 +" timeout=1 >

Re: Issue while Centralizing SUDO with OpenLDAP

2011-05-23 Thread Ralf Haferkamp
Am Freitag 20 Mai 2011, 14:35:31 schrieb pradyumna dash: > Hi Buchan, > > Thanks for your reply. I have tried but the schema is not getting > loaded, dont know why. How did you try adding the schema? What error messages did you get? Are you using slapd.conf or back-config? > I have tried the sa

Re: openLDAP C++ API

2011-03-04 Thread Ralf Haferkamp
Am Donnerstag 03 März 2011, 23:02:40 schrieb sim123: > Hi, > > I am evaluating openLDAP and need to perform ldapsearch from C++ > program. I looked at openLDAP C++ API, however README says its an > unstable release. Hm, seems I need to give the README some love ;). > So just wanted to understand,

Re: authz-regexp and uid's

2011-02-02 Thread Ralf Haferkamp
Am Dienstag 01 Februar 2011, 18:19:33 schrieb Derek Bodner: > Hello, > I'm running an ldap 2.3 server, with users setup under cn= > ,ou=People,dc=org,dc=com. I have an application that is > trying to access the dn's directly, via > uid=,ou=People,dc=org,dc=com > > I've setup an authz-regexp rule

Re: "slapadd: corrupted double-linked list"

2011-01-17 Thread Ralf Haferkamp
Am Montag 20 Dezember 2010, 14:17:23 schrieb Dieter Kluenter: > Am Fri, 10 Dec 2010 09:46:06 +0100 [..] > I can reproduce this error on SLES-11 and SLES-11SP1. An excerpt of > valgrind log: BTW, I just filed ITS#6794 for this bug, which I was able to finally reproduce on stock 2.4.23 and current H

Re: "slapadd: corrupted double-linked list"

2010-12-15 Thread Ralf Haferkamp
Am Freitag 10 Dezember 2010, 09:46:06 schrieb Marc Patermann: > Howard, > > Howard Chu schrieb am 09.12.2010 18:21 Uhr: > > Marc Patermann wrote: > >> Marc Patermann schrieb am 09.12.2010 11:40 Uhr: > >>> Howard Chu schrieb am 08.12.2010 18:55 Uhr: > Marc Patermann wrote: > > Marc Paterma

Re: Error 18: Solaris 10 Native LDAP-Client

2010-11-03 Thread Ralf Haferkamp
Am Dienstag 02 November 2010, 18:03:56 schrieb Ralf Haferkamp: > Am Dienstag 02 November 2010, 16:57:38 schrieb Benjamin Griese: [..] > > Something like this should work: > > access to dn.base="" attrs=supportedControl > val/objectIdentifierMatch=1.2.840.113556.1.4.

Re: Error 18: Solaris 10 Native LDAP-Client

2010-11-03 Thread Ralf Haferkamp
Am Mittwoch 03 November 2010, 09:52:26 schrieb Benjamin Griese: > Hello Ralf, > [..] > In the meantime I set the ACL, but unfortunatly it didn't help solving > the problem, you may take a look at my example: > > DN: olcDatabase={1}hdb,cn=config > olcAccess: {0}to attrs=userPassword,shadowLastChan

Re: Error 18: Solaris 10 Native LDAP-Client

2010-11-02 Thread Ralf Haferkamp
Am Dienstag 02 November 2010, 16:57:38 schrieb Benjamin Griese: > Hello Ralf, > > nice to know that someone from Novell is reading here, too. > > Currently I have opened up a Service Request regarding this topic at > Novells Suport Center and pointed that out as a Feature Request but > also as pr

Re: Error 18: Solaris 10 Native LDAP-Client

2010-11-02 Thread Ralf Haferkamp
Am Donnerstag 28 Oktober 2010, 19:57:17 schrieb Benjamin Griese: > Hello James, > > thanks for replying giving us your opinion. > Sometimes I thought I was the only person who has the problem you're > talking of. I am in the same dilemma as you are, using SLES11 /w SP1 > and have a not working sol

Re: Problem updating cn=config directory

2010-10-28 Thread Ralf Haferkamp
Hi, Am Donnerstag 28 Oktober 2010, 16:03:54 schrieb Bram Cymet: > Well I figured it out. For some reason my masters has a syncrepl > statement for the cn=config database but replication to itself. If the syncrepl statement did really point to the server itself (using the machine's full qualifie

Re: bindpw in SSHA/MD5/CRYPT/...

2010-10-27 Thread Ralf Haferkamp
Am Dienstag 26 Oktober 2010, 10:49:09 schrieb Frederic Hornain: > Dear all, > > For already few weeks, I search for a mean to have an encypted bindpw > password in /etc/ldap.conf on my Fedora Linux Ldap client. > OK, I have perfectly understood a simple bind requires that the client > has the *cle

Introducing the slapd kinit module

2010-10-26 Thread Ralf Haferkamp
Hi, a few days ago I committed the new kinit plugin to the CVS tree. It's sole purpose is to have slapd request a Kerberos TGT and keep it renewed as long as slapd is running. Especially useful e.g. if your syncrepl consumer uses SASL/GSSAPI for authentication (basically all setups where slapd

Re: Sometimes getent missing users

2010-10-20 Thread Ralf Haferkamp
Hi, Am Mittwoch 20 Oktober 2010, 08:33:32 schrieb Jocke M: > Hi, > > I did use the ldapsearch and here is what I found out > > ldapsearch "ldapserver" returned 1586 users > /etc/passwd has 38 users > > nsswitch.conf > passwd: files ldap > > So sometimes I assume getent returns files (38) +

Re: ppolicy causing slapcat to segfault

2010-10-18 Thread Ralf Haferkamp
On Friday 15 October 2010 20:45:11 Ryan Steele wrote: > For reference, this is a slightly older installation (2.4.17 on > Ubuntu). I was recently informed that we had to implement the > ppolicy overlay ASAP for compliance reasons in this environment. I > don't have time to upgrade this particular

Re: A LDAPS related issue

2010-09-24 Thread Ralf Haferkamp
Am Freitag 24 September 2010, 10:08:32 schrieb Michael Ströder: > Ralf, > > thanks for your followup on this. > > Ralf Haferkamp wrote: > > On Wednesday 22 September 2010 19:05:58 Michael Ströder wrote: > >> Ralf Haferkamp wrote: > >>> If you reall

Re: A LDAPS related issue

2010-09-23 Thread Ralf Haferkamp
On Wednesday 22 September 2010 19:05:58 Michael Ströder wrote: > Ralf Haferkamp wrote: > > If you really want the TLS context recreated with each iteration I > > think you can just call: > > ldap_set_option( NULL, LDAP_OPT_X_TLS_NEWCTX, LDAP_OPT_ON); > > after the above

Re: How to slapadd cn=config

2010-09-21 Thread Ralf Haferkamp
On Tuesday 21 September 2010 13:55:08 Torsten Schlabach (Tascel eG) wrote: > Hi Howard! > > > Exactly the same way as you slapcat'd it. > > I don't actually understand ... ?? > > > What was the exact command line you used for slapcat? > > slapcat -b 'cn=config' Then try: slapadd -F -bcn=con

Re: A LDAPS related issue

2010-09-21 Thread Ralf Haferkamp
On Tuesday 21 September 2010 03:17:48 ctosgh wrote: > Seems nobody run into this issue?? > > > > At 2010-09-20 10:02:10,ctosgh wrote: > > Hi, folks > > I am using the APIs from openldap and recently run into a problem > which upset me. Following is the framework of the function. > ldaps_func

Re: Able to delete olcDbIndex config attribute, but not add it.

2010-07-22 Thread Ralf Haferkamp
Am Montag 12 Juli 2010, 13:48:11 schrieb Ian Collins: > Hello, > > While attempting to add an extra index to an existing config, I was > able to (accidentally!) delete the attribute, but not add it back: > > dn: olcDatabase={1}hdb,cn=config > changetype: modify > delete: olcDbIndex > > modifying

Re: segmentation fault when attempting to delete olcOverlay={0}syncprov entry in cn=config (Runtime) Configuration

2010-07-21 Thread Ralf Haferkamp
the issue, so this leads me to > believe it is a timing related issue. > On Wed, Jul 21, 2010 at 9:18 AM, Ralf Haferkamp wrote: > > Am Dienstag 20 Juli 2010, 20:25:46 schrieb jon brandt: > > > I looked but couldn't find a match to this issue, so was wondering > >

Re: segmentation fault when attempting to delete olcOverlay={0}syncprov entry in cn=config (Runtime) Configuration

2010-07-21 Thread Ralf Haferkamp
Am Dienstag 20 Juli 2010, 20:25:46 schrieb jon brandt: > I looked but couldn't find a match to this issue, so was wondering if > anyone else has seen something like it or can tell what might be > wrong in my configuration. Thanks in advance! > > I'm using OpenLDAP version 2.4.21-47.1 (here is the

Re: Recommended way to modify cn=schema entries?

2010-07-13 Thread Ralf Haferkamp
Am Montag 12 Juli 2010, 18:00:29 schrieb Quanah Gibson-Mount: > --On Monday, July 12, 2010 11:43 PM +1200 Ian Collins > > > wrote: > > On 07/ 6/10 02:12 PM, Ian Collins wrote: > >> I would like to re-order two schema entries to resolve a dependency > >> issue (our local schema, included before dy

Re: LDAP proxy with local database

2010-07-01 Thread Ralf Haferkamp
Am Mittwoch 30 Juni 2010, 12:14:05 schrieb Tunguskin Petr: > Hello. > > I have one program which can authenticate with LDAP server and Active > Directory with read access. I need to authenticate extra users, but I > can't add them to Active Directory for security reasons. Program can > work with o

Re: ldapsearch using entryCSN

2010-06-25 Thread Ralf Haferkamp
Am Donnerstag 24 Juni 2010, 15:19:38 schrieb Pierre Laporte: > My mistake, main problem solved. > > Spaces are not allowed in ldap queries. In fact, I didn't get "no > result", I got one message "Bad search filter" that was not handled > correctly. > > I changed my filters so that it now uses the

Re: openldap library and LDAP_OPT_X_KEEPALIVE_IDLE

2010-04-30 Thread Ralf Haferkamp
Am Freitag 30 April 2010 14:26:00 schrieb Fred MAISON: > Hello, > Could someone tell which openldap library version first included > keepalive paches giving acces to following options : > LDAP_OPT_X_KEEPALIVE_IDLE > LDAP_OPT_X_KEEPALIVE_PROBES > LDAP_OPT_X_KEEPALIVE_INTERVAL They where introduced

Re: Where to start a migration from passwd/shadow/smbpasswd to openldap

2010-03-29 Thread Ralf Haferkamp
Am Freitag 26 März 2010 14:29:04 schrieb Buchan Milne: > On Friday, 26 March 2010 11:27:28 Götz Reinicke - IT-Koordinator wrote: > > Buchan Milne schrieb: > > >> For the rgc2307 vs rfc2307bis group issue, I don't think samba > > > supports rfc2307bis, so you should go with rfc2307 (using memberUid

Re: a newbie trying to get the basics of syncrepl going

2010-02-25 Thread Ralf Haferkamp
Am Donnerstag 25 Februar 2010 13:57:04 schrieb Seger, Mark: [..] > >I think the documentation is unclear, possibly confusing. > > > >As I tried to elaborate, what it means is that, given an existing > >provider/consumer setup, a new consumer server can be added without > >restarting the provider se

Re: Syncrepl in OpenLDAP-2.4.20

2010-02-22 Thread Ralf Haferkamp
Am Sonntag 21 Februar 2010 19:34:22 schrieb Ralf Zimmermann: > Hi all, > > today I have made tests with Version 2.4.21 and my 2.4.20 > configuration. When I start slapd I get following error message: > > config error processing olcDatabase={1}hdb,cn=config: > invalid URL olcSyncrepl: value #0:

Re: Some openldap 2.4 questions

2010-01-19 Thread Ralf Haferkamp
Am Montag 18 Januar 2010 11:07:50 schrieb Radosław Antoniuk: > Hi again guys, > > Ok, coming back on the technical track. > Nobody replied so I'll ask again.. and few more thoughts actually: > > 1. Is it okay to stop the daemon, and literally remove the lines from > the config files in slapd.d di

Re: problem configuring overlay module and cn=config

2010-01-19 Thread Ralf Haferkamp
Am Sonntag 10 Januar 2010 09:07:18 schrieb Alex Samad: > Hi > > I am trying to ldapadd > > > dn: olcOverlay={2}unique,olcDatabase={1}hdb,cn=config > changetype: modify > add: olcunique_uri > olcunique_uri: ldap:///?uid?sub > > > but it fails > ldap_modify: Undefined attribute type (17) >